I'm running a search head cluster behind a load balancer. I'm migrating some servers to using a non-root splunk user which has made this fairly obvious to me, but I believe it's happening anyway.
When splunk sends out an email, it appends the local server's port number to the server's email setting for "Link Hostname". For a loadbalanced system, where your web service is usually on port 443, but the back-end service can be any port (eg 8443), this poses an issue.
So, at the moment I'm getting links coming out with `https://:` (EG: `https://splunk.glb:8443` when the load balancer is only listening on port 443), which is OK for a couple of servers but wrong for the others.
↧